WordPress Faces 90,000 Automated Attacks Per Minute Globally

WordPress doesn’t get targeted because your organization is “special.” It gets targeted because WordPress is everywhere. With that market share comes a blunt reality: WordPress faces roughly 90,000 automated attacks per minute globally. These aren’t humans picking you out of a lineup. They’re bots running playbooks at scale, probing for the same weak doors across thousands of sites.

That volume changes how you should think about risk. Even if every individual attempt is low-sophistication, the aggregate impact is real. Login endpoints get hammered with credential stuffing. Old paths and known plugin fingerprints get scanned repeatedly. XML-RPC and API routes attract noisy traffic. The result is not just “security.” It’s operational drag: higher CPU usage, bloated logs, false alerts, and performance spikes that can look like an infrastructure problem rather than an attack.

For teams with compliance obligations, the cost shows up in uncomfortable places. More exceptions to explain. More monitoring gaps to justify. More “we’ll address that later” items that turn into audit findings. And for organizations where brand trust is tied to uptime, even a short degradation during a campaign, product launch, or investor update can punch above its weight.

The path forward is to stop treating WordPress automated attacks like edge cases and start treating them like background radiation. Put controls where the traffic first hits: your CDN and WAF. Configure rules that block common attack patterns, throttle abusive requests, and challenge suspicious clients before they touch PHP or the database. Then add bot mitigation to reduce scraping and automated abuse that slips through generic rules.

You don’t need perfection. You need a front door that’s built for the reality you’re already living in. Most bots don’t “break in.” They just keep knocking until something gives. Harden your edge layer so junk traffic gets filtered before it hits WordPress.

Source: Trezie, Why a Maintenance Plan is Essential for Your WordPress Website